Slightly tangent to the random aside, but actively preventing the user from entering a bad password is very often bad because 99% of people implementing such a check have no idea what constitutes a good password, and the check actually enforces a bad one.

(Relevant xkcd: https://xkcd.com/936/)

I especially get mad at absurdly small (<200 chars) maximum lengths; a response of "but we require special characters" is bull. Increasing the size of the character space increases entropy by O(n^k) (polynomial); increasing the length increases entropy by O(k^n) (exponential). Anyone who's taken an undergrad algorithms course or even AP Comp Sci should understand this.